Slides from webinar presented on March 6, 2018 by eZ guest speaker Janne Kalliola, CEO at Exove and GDPR expert. Janne discussed practical approaches to dealing with the upcoming GDPR regulation, including both the legal and technical aspects. He also addressed how GDPR affects content management systems.

1. GDPR Is Around the Corner -
Don’t Panic
EXOVE 2018

2. About Exove
● Digital design and development
company in Finland, Estonia, the UK, and
Singapore
● Full service portfolio from business
consulting and service design to
development and care
● We serve both multinational giants and
new start-ups alike
● We deliver digital growth
More about us:
● www.exove.com
● www.exove.com/gdpr
● @exove

3. About Janne Kalliola
● Founder and CEO of Exove
○ Before Exove, worked at
Continuent, First Hop, SSH, HUT
● Been coding since 1983, first web stuff in
1994
● Worked with web publishing and
content managements systems since
1999
○ I’ve written three CMS in the past
More about me:
● www.kallio.la
● linkedin.com/in/jannekalliola
● @plastic

4. Agenda
● EU Privacy - General Data Protection Regulation in a nutshell
○ Background
○ New rights for individuals
○ New requirements for companies
● Content management systems and their specialties
○ Structured and unstructured data
○ Analytics
○ Leaking data inadvertly
● What to do?
○ Practical approach
● Questions & answers

5. General Data Protection
Regulation

6. GDPR?
General Data Protection Regulation
Is the EU’s new privacy regulation that harmonises the managing personal
data in the member states and gives new rights to the individuals.
Replaces old directive (95/46/EC) that is outdated and implemented
differently in member states.

7. GDPR in a Nutshell
● GDPR is a regulation, thus it is in
force in all member states without
local legislation
● Needs local legislation to be
compatible with the regulation and
allows a lot of locally adjustable
details
● Adds rights to individuals and
responsibilities to companies
● Applies to all companies -
worldwide - that process
personal data of an EU resident
● GDPR is in force already
● We are currently on a transition
period that ends on May 25th,
2018
● GDPR imposes administrative
sanctions that can be
considerable

8. Two Data Handling Roles
Controller
● The company collecting the data
and controlling its usage
● Responsible for and able to
demonstrate compliance with
the regulation
○ Including also work done by
processors
Processor
● A company that processes
personal data on behalf of a
controller
● Must be contractually bound
to the controller and follow
written orders
● Must return or delete data
when contract ends

9. Broad Definition of Personal Data
● GDPR broadens the definition of personal data:
○ Any information concerning an identified or identifiable natural person -
such as name, telephone number, email address, car license plate,
dynamic IP address – thus very broad interpretation
○ Pseudonymized data that can be reversed to identifiable with additional
data
● GPDR also defines sensitive data that must be handled with special care
○ Political affiliation, health records, genetic & biometric data, etc.
● Children are identified as vulnerable individuals that require specific
protection
○ Consent given by person with parental responsibility for the child

10. Other Major Concepts
● Transparency and consent – The individuals need to know how and why
their data is used, and companies need to have valid reason for the data
usage
○ Several valid reasons, such as contractual, legal, and based on consent
○ If consent is given, it can be withdrawn anytime
● Privacy by design and default – Systems need to be designed to take
privacy into account from the very beginning
● Accountability – Organisations must be able to proof that they are following
the regulation, i.e. reversed burden of proof
○ Requires process documentation, paper trails of decisions, and in some
cases privacy impact assessments

11. Rights of the Individuals (1/2)
● Access to data – The individuals must be able to see the data
collected about them
○ By request that needs to be followed in a month – there are
extensions for some cases, in commonly used electronic format.
○ First copy must be free of charge
● Rectification of inaccurate data – The individuals can ask inaccurate
data to be corrected
● Right of erasure – The individuals can ask data to be removed
● Object of processing – The individuals can stop specific kind of
processing, for example, direct marketing

12. Rights of the Individuals (2/2)
● Portability – The individuals have right to have their data ported to
them or to another service
● Restricting processing – The individuals can ask to stop processing
their data for a period of time.
○ Data can also be temporarily removed in this case
● Profiling and automated decision-taking – Profiling based on
sensitive data requires explicit consent and the individuals can
request manual intervention of automated decision-taking that cause
them significant effects

13. Data Transfers
● Transfers outside EEA (European Economic Area) are restricted, but
not forbidden
● Transfers require adequate level of data protection, such as following
EU model clauses
● Number of safe countries whose regulation provides similar
protection of personal data as GDPR
● Safe Harbor is now replaced with Privacy Shield, a new deal to
self-certify US companies to allow hosting data regulated by the
GDPR

14. Data Breaches
● Processors need to inform the controller “without undue delay after
becoming aware of it”, without exceptions
● Controllers need to inform the authorities within 72 hours after
becoming aware of the breach
● In some cases, the controller will need to inform the data subjects
about the breach

15. Implications for UX
● Consent is more regulated than before
○ Needs to be specific and unambiguous, cannot be part of other
written agreements
○ Must be active – i.e. no pre-ticked checkboxes
○ Must be reversible
○ Record of the given consent is required
○ Consent cannot be required for a service that works also without
processing personal data
● Privacy policy is more important than before
○ Data has to have storage times, and a lot of other tidbits

16. Changes in Contracting
● Controller must have written contract with every processor
○ Responsibility goes to the end of the subcontracting chain
● The contract has mandatory clauses stipulated by GDPR
● The actions done by a processor must be defined in writing

17. Content Management System
Specialties

18. Structured vs. Unstructured Data
● Most of the data processed by computers is structured, in other words
it contains named fields that might have types
○ Structured data is easy to put into spreadsheets
● Content management systems handle a lot of unstructured data – the
content
○ Unstructured data is easy to put into documents
○ This data is also under GDPR

19. Content and GDPR
● Content contains easily a lot of personal information, such as names,
email addresses, phone numbers, images of people
● These cannot easily be exported from the system to satisfy end user
rights
● Thus, one needs to be diligent
○ Best solutions are to make suitable content types and other
structures that move a lot repeating data into structured data
○ For example, staff listing implemented as a list of persons and not
freely editable page

20. Consent
● Remember also to have consent from people to use their personal
information
○ Discussion forums, blog comments, etc.
● This applies to your own personnel, too
○ Using names and photos in a staff listing needs a consent
● It does not help whether you use company provided email addresses
or phone numbers, as people can still be identified using them – thus
they are also personal information

21. Analytics
● Using analytics is ok in general
● It is good to check what kind of data goes into analytics and how the
system processes them
○ Even if does not store the data, it might temporarily be accessible
by the personnel of the analytics provider
○ And this needs to be covered in the contract between you and
them
● IP address is a typical piece of data transferred to analytics
○ Some solutions – such as Google Analytics – offer anonymisation
of IP address before sending it to the analytics

22. Access and Error Logs
● Content management systems generate various logs for administrative
and error management purposes
○ These logs have at least the IP address of the user and thus are
also full of personal data
● The procedures for such logs need to be checked
○ Who has access to them
○ Whether they are exported to an analysis system
● Also own or third party extensions to CMS may write own log files
● Debug mode may cause more personal data to be written to the files

23. URLs
● Your system may transfer personal data in URLs, such as
○ https://example.com/person/?name=Janne+Kalliola&birthdate=...
● All systems storing that URL – logs, analytics, etc. – suddenly may
contain way more personal data that you know and have defined in
your processes
● Also transaction ids and other pieces of data that identify a single user
are considered personal data

24. Staging and Development Environments
● GDPR affects to all systems, including also staging and development
environments
○ In case of requests from users, the data in these systems need to
be included in erasure, rectification, etc.
● When data is copied from production to staging or development –
typically to debug issues – special care is needed
○ As people tend to have a more relaxed attitude towards these
systems, the probability of data leaks increase

25. What Now?

26. My Advice
● This is for real, so better be prepared
● If you have not yet started, the chances are that you are late
○ But it is still advisable to start now
● Everything that you do now should already be compliant with GDPR
○ Pay attention to your data architecture
○ Think of user rights and how they are implemented
● Train your people
● Get external help, if you do not know how to proceed

27. You Need to Know Where You Stand
● You need to understand GDPR and its effects to your organisation
● You must understand how data flows in your systems
○ Where, what and why data is stored
○ Check whether data is flowing out of EU or to another controller
● You must have defined and followed procedures for handling personal data
○ These are typically mostly non-existent in most companies
● You need to have written contracts with all your partners related to personal
data
● You need to be moving now and be compliant by May 25th, 2018
○ There might be some leeway, but I would not count on it
● And if you do nothing, you are just asking for troubles

28. Two-Way Approach
● When we work with GDPR, we typically split the work into two parts:
○ Gap analysis – understanding current position and the gap
towards the compliance by listing the systems, describing data
flows between them, and defining the gathered, transferred, and
stored personal data
○ Compliance program – a complete undertaking to ensure GDPR
compliance, includes changes of processes, systems,
documentation, and user-facing policies

29. Gap Analysis
● Gap analysis exposes the most critical omissions and other issues with
regards to GDPR quite quickly
○ It is mostly done as a desktop research
○ We have found that the administrators of systems are better
source of information than the vendors of the same systems
● There are tools to support the work, but it can be also done using
documents and spreadsheets
● Someone needs to own the project
● The management needs to show interest in the results

30. Compliance Program
● The compliance program is a long process of fixing everything to be
compliant with GDPR
○ The task list must be prioritised, typically quite heavily
○ The key is to reduce “problem surface” as quickly as possible
○ So focus on the main businesses, the most important systems, the
most crucial personal data first
● You need to make sure that your vendors are interested in helping you
○ It is a shared undertaking
○ Be fair while being also demanding
● It is crucial to get this off the ground before May 25th

31. Keeping Up with GDPR
● Gap analysis and compliance programs make you compliant with
GDPR for that specific moment when the projects are over
● If you do not sustain the right use of personal data, you will go back to
your old ways – that are most probably not compliant
● Everyone needs to change the way how they think about personal
data and privacy
○ Your staff, vendors, etc.
● The processes are as good as the people implementing them
● So keep focus on personal data after the big push until it becomes a
second nature

32. So What Now?
● This might sound very exhaustive and even impossible task
● But there are no other decent choices than to comply
● So, it is crucial to take the first step and then continue walking
You will reach the destination sooner or later,
as long as you keep moving.

33. Questions & Answers

34. Thank You!
EXOVE
Janne Kalliola
janne@exove.com
+358 40 558 1796

35. Gap Analysis
Description
Bird&Bird asks the juridical questions and
Exove focuses on ICT. The questionnaires
are sent typically to people responsible for
ICT, HR, legal and business
Bird&Bird and Exove study the results and
write an analysis of the situation
Bird&Bird and Exove organise a three hour
workshop with the key people of the client
OPTION: The report is gone through with
the client and the situation is assessed to
understand how the client will reach legally
and technically required compliant state.
Contents Results
Report with around ten point list of the
current situation and action points.
Offer for executing a GDPR compliance
program
IT Juridical
Analysis
Workshop
GDPR compliance program

36. Compliance Program
● Bird & Bird and Exove plan and execute a complete compliance
program
● Based on the gap analysis findings, industry of the client, and assessed
risks
● Includes changes to processes, documentation, technology, UX, and
contracts
● The depth of the work is to be agreed on case by case basis